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Claims 

[d] A method for providing secure access to applications, 
the method comprising the steps of: 
receiving a request from a user to execute an applica- 
tion; 

determining a minimal set of computing privileges nec- 
essary for the user to use the requested application; and 
invoking an execution environment for the user having 
the determined set of privileges. 

[c2] The method of claim 1, comprising the further step of: 
returning an identifier for the execution environment to 
the requesting user. 

[c3] The method of claim 2, wherein the identifier is used to 
using the identifier and a remote presentation level pro- 
tocol to connect the user to the execution environment. 

[c4] The method of claim 1 wherein step (a) comprises re- 
ceiving an HTTP-based request from a user to execute 
an application. 

[c5] The method of claim 1 wherein step (b) comprises ac- 
cessing a policy-based decision system to determine a 
minimal set of computing privileges necessary for the 



user to use the requested application. 

[c6] The method of claim 1 wherein step (b) comprises ana- 
lyzing requirements of an application to determine a 
minimal set of privileges necessary for the user to use 
the requested application. 

[c7] The method of claim 1 further comprising the step of re- 
ceiving an indication of a dataset on which the applica- 
tion operates. 

[c8] The method of claim 5 wherein step (b) comprises ac- 
cessing a confidentiality policy associated with the iden- 
tified dataset to determine a minimal set of computing 
privileges necessary for the user to use the requested 
application. 

[c9] The method of claim 1 wherein step (b) further com- 
prises determining a minimal set of computing privileges 
necessary for the user to use the requested application 
based, at least in part, on a role assigned to the user. 

[do] The method of claim 1 wherein step (c) further com- 
prises creating an execution environment for the user 
having the determined set of privileges. 

[cH] The method of claim 1 wherein step (c) further com- 
prises identifying a previously-existing execution envi- 



ronment for the user having the determined set of privi- 
leges. 

[d2] The method of claim 1 further comprising the step of re- 
ceiving from the user a request to execute a second ap- 
plication. 

[d3] The method of claim 10 further comprising the steps of: 
determining a minimal set of computing privileges nec- 
essary for the user to use the second requested applica- 
tion; and 

invoking a second execution environment for the user 
having the second determined set of privileges. 

[d4] The method of claim 1 further comprising the steps of 
initiating a connection with a client system associated 
with the user. 

[d5] An application server system providing secure access to 
hosted applications, the system comprising: 
a policy based decision system receiving a request from 
a user to execute an application and determining a mini- 
mal set of privileges required by the user to execute the 
application; and 

an account administration service in communication with 
said policy based decision system, the account adminis- 
tration service invoking an execution environment for 



the user having the determined set of privileges. 

[d6] The system of claim 15 further comprising a connection 
manager in communication with said policy based deci- 
sion system, said connection manager receiving from a 
client system a request by the user to execute the appli- 
cation and transmitting to said policy based decision 
system an identification of said user and an identification 
of said application. 

[d7] The system of claim 16 wherein said connection man- 
ager communicates with the client using a presentation- 
level protocol. 

[d8] The system of claim 17 wherein said presentation-level 
protocol is selected from the group consisting of RDP, 
ICA, and X. 

[d9] The system of claim 15 wherein said connection man- 
ager transmits an identification of the user's role to said 
policy based decision system. 

[c20] The system of claim 15 wherein said policy-based deci- 
sion system is based on a declared plurality of rules. 

[c21] The system of claim 15 wherein said policy-based deci- 
sion system analyzes a set of requirements of the re- 
quested application to determine a minimal set of privi- 



leges required by the user to execute the requested ap- 
plication. 

[c22] The system of claim 15 wherein said connection man- 
ager receives an identification of a dataset that the ap- 
plication will process. 

[c23] The system of claim 18 wherein said policy based deci- 
sion system accesses a confidentiality policy associate 
with the identified dataset to determine a minimal set of 
privileges required by the user to execute the applica- 
tion. 

[c24] The system of claim 15 wherein said account adminis- 
tration service creates an execution environment having 
the determined minimal set of privileges. 

[c25] The system of claim 15 wherein said account adminis- 
tration service identifies a previously-existing execution 
environment having the determined minimal set of privi- 
leges. 

[c26] An article of manufacture having embodied thereon 

computer-readable program means for providing secure 
access to applications, the article of manufacture com- 
prising: 

computer-readable program means for receiving a re- 
quest from a user to execute an application; 



computer- read able program means for determining a 
minimal set of computing privileges necessary for the 
user to use the requested application; and 
computer-readable program means for invoking an exe- 
cution environment for the user having the determined 
set of privileges. 

[c27] The article of manufacture of claim 27 further compris- 
ing computer-readable program means for accessing a 
policy-based decision system to determine a minimal set 
of computing privileges necessary for the user to use the 
requested application. 

[c28] The article of manufacture of claim 27 further compris- 
ing computer-readable program means for determining 
a minimal set of computing privileges necessary for the 
user to use the requested application based, at least in 
part, on a role assigned to the user. 

[c29] An application server system providing secure access to 
hosted applications, the system comprising: 
a policy based decision system receiving a request from 
a user to execute an application and determining a mini- 
mal set of privileges required by the user to execute the 
application; 

an account administration service in communication with 
said policy based decision system, the account adminis- 



tration service invoking an execution environment for 
the user having the determined set of privileges; and 
a connection manager in communication with said policy 
based decision system, said connection manager receiv- 
ing from a client system an RDP request by the user to 
execute the application and transmitting to said policy 
based decision system an identification of said user and 
an identification of said application. 



